Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system -
submitted
10/12/2023, 20:42
Static task
static1
Behavioral task
behavioral1
Sample
tuc5.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
tuc5.exe
Resource
win10v2004-20231130-en
General
-
Target
tuc5.exe
-
Size
6.9MB
-
MD5
b4336ca6bab18f9d3521804993eeefd9
-
SHA1
1f35615eef691d59ccdbde87bd02f7a6d5fc40c5
-
SHA256
477959c8aecaf3cd9d0e105024d647b936d9595bf726a33d82f5df7990e36921
-
SHA512
f3d8f4cf595273203a7d15f55d491af64d520bfefb020254b318eed657d9790c5308a32fb4624d23c2469da35358f9770d5a9f1c1f716fee8c2038fc3bec0222
-
SSDEEP
196608:IxnTNzjsOzc7TGHscDgcXbIdslX38dgFYJzj:gNztzQlcDPXus98d9Jzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1704 tuc5.tmp 764 crtgame.exe 2892 crtgame.exe -
Loads dropped DLL 6 IoCs
pid Process 2152 tuc5.exe 1704 tuc5.tmp 1704 tuc5.tmp 1704 tuc5.tmp 1704 tuc5.tmp 1704 tuc5.tmp -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 194.49.94.194 Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\CRTGame\bin\x86\is-UTNA9.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-QAFSI.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-20S50.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-H2P1Q.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-MO9ME.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-KQG6M.tmp tuc5.tmp File opened for modification C:\Program Files (x86)\CRTGame\crtgame.exe tuc5.tmp File created C:\Program Files (x86)\CRTGame\uninstall\unins000.dat tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-SV5UI.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-H0CBL.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-CV2K6.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-12RO7.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-G5RPP.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-5ADOT.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-JU12J.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\uninstall\is-5FC4S.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-87UL9.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-NTQ7U.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\is-MUM4M.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-ROIBD.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-9HJF4.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-6SCI9.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-OU4VS.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-N484U.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-G76VL.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-FBDT3.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-URAMT.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GF5TV.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-LO7V5.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-QV58T.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-UHM4D.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\lessmsi\is-PVO2P.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-3IT25.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-ITVST.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-H686S.tmp tuc5.tmp File opened for modification C:\Program Files (x86)\CRTGame\uninstall\unins000.dat tuc5.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-H8A63.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-C94L1.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-T4FFL.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-G7JB3.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-BJTL2.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-B7GI2.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-GFLFG.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DTISM.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-QM18H.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-1MAIM.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-QL9N2.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-461V0.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-ELOIO.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-N3HFP.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-4RUOC.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-97O7S.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-CH4JN.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\stuff\is-D8416.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-Q8Q21.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-H649S.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-Q3FFC.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-QLC4M.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-I8D42.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-R4MD2.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-T14PE.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-0SKHO.tmp tuc5.tmp File created C:\Program Files (x86)\CRTGame\bin\x86\is-DEPN1.tmp tuc5.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1704 tuc5.tmp -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2152 wrote to memory of 1704 2152 tuc5.exe 28 PID 2152 wrote to memory of 1704 2152 tuc5.exe 28 PID 2152 wrote to memory of 1704 2152 tuc5.exe 28 PID 2152 wrote to memory of 1704 2152 tuc5.exe 28 PID 2152 wrote to memory of 1704 2152 tuc5.exe 28 PID 2152 wrote to memory of 1704 2152 tuc5.exe 28 PID 2152 wrote to memory of 1704 2152 tuc5.exe 28 PID 1704 wrote to memory of 816 1704 tuc5.tmp 31 PID 1704 wrote to memory of 816 1704 tuc5.tmp 31 PID 1704 wrote to memory of 816 1704 tuc5.tmp 31 PID 1704 wrote to memory of 816 1704 tuc5.tmp 31 PID 1704 wrote to memory of 764 1704 tuc5.tmp 30 PID 1704 wrote to memory of 764 1704 tuc5.tmp 30 PID 1704 wrote to memory of 764 1704 tuc5.tmp 30 PID 1704 wrote to memory of 764 1704 tuc5.tmp 30 PID 1704 wrote to memory of 1616 1704 tuc5.tmp 35 PID 1704 wrote to memory of 1616 1704 tuc5.tmp 35 PID 1704 wrote to memory of 1616 1704 tuc5.tmp 35 PID 1704 wrote to memory of 1616 1704 tuc5.tmp 35 PID 1704 wrote to memory of 2892 1704 tuc5.tmp 34 PID 1704 wrote to memory of 2892 1704 tuc5.tmp 34 PID 1704 wrote to memory of 2892 1704 tuc5.tmp 34 PID 1704 wrote to memory of 2892 1704 tuc5.tmp 34 PID 1616 wrote to memory of 2704 1616 net.exe 33 PID 1616 wrote to memory of 2704 1616 net.exe 33 PID 1616 wrote to memory of 2704 1616 net.exe 33 PID 1616 wrote to memory of 2704 1616 net.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\tuc5.exe"C:\Users\Admin\AppData\Local\Temp\tuc5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\is-G0U4F.tmp\tuc5.tmp"C:\Users\Admin\AppData\Local\Temp\is-G0U4F.tmp\tuc5.tmp" /SL5="$70122,7025884,54272,C:\Users\Admin\AppData\Local\Temp\tuc5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -i3⤵
- Executes dropped EXE
PID:764
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:816
-
-
C:\Program Files (x86)\CRTGame\crtgame.exe"C:\Program Files (x86)\CRTGame\crtgame.exe" -s3⤵
- Executes dropped EXE
PID:2892
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 103⤵
- Suspicious use of WriteProcessMemory
PID:1616
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 101⤵PID:2704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
645KB
MD53fbdf8f39d577767bcff787d03c3c8be
SHA15d008cd329bff65513c5488c20899c010c051a2e
SHA256763bc16049d0add347733f62a57557992aa7d3ec1e95e604739bd400fea670af
SHA51205c35a507e3443f1a770f6f62d84af49415588f11cfbdf2060b4b7aad6b197e621b313408dd55e7870b66a732d21edfe5c47a63c9e8311a6c7051b4efed45a71
-
Filesize
303KB
MD5c937d9c14e45c9311faade50f7389ad7
SHA1fe4b41e0a4535eb47936cbd0057fa656968a9519
SHA256ead059d11c6f4a526293aa5a6aa1c6fab7cb38dee04731e8b898bf3e4b9277a3
SHA512eacdbac7e122c573858aa4d22ab3a36135c26eb51fc3944731dfc2984e4ba73d40d10a78ac52c3c158ddf45c7a5cf100f81f23d035a0d79b6e76cfea69881940
-
Filesize
307KB
MD5633ca523c269d2f15db8020d4601fa99
SHA1e377051e47a95ff0b680067e395497d7674512f6
SHA2563102f1e59aa41da877537a9b9dcc50738a8c53bf93c58f4c4dfe29f36217722a
SHA5129682f65f8e171f14fade7de5259fecafabf6bd2e08d747874ff5b4f2c17a29820c2d42062097487dfbb7b8ea89c4016eccf3805336c6d6ce4ad700dc51fc6dc3
-
Filesize
370KB
MD51847987be89fd94dc799a8a3d444359c
SHA1b352b96500b7943a7cf80ecf5b23476b8eaf6e69
SHA2560815cd00fe596da5e63295f8f1ff1347f30afb67a0edf0699b0524f53ff2f834
SHA51267fc409c01d73219fcd12340f62835068bc5d064f71c88e4903208f54d928d2e2fcd4bbe09e9fbb61192f5f1e562804a75a7b93aade05e1b754929d334b89f41
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4